Security Vulnerabilities - CVEs Published In February 2023
A vulnerability, which was classified as critical, has been found in uakfdotb oneapp. This issue affects some unknown processing. The manipulation leads to sql injection. The attack may be initiated remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 5413ac804f1b09f9decc46a6c37b08352c49669c. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221483.
CVSS Score
6.3
EPSS Score
0.0
Published
2023-02-20
Liima before 1.17.28 allows server-side template injection.
CVSS Score
9.8
EPSS Score
0.004
Published
2023-02-20
Liima before 1.17.28 allows Hibernate query language (HQL) injection, related to colToSort in the deployment filter.
CVSS Score
9.8
EPSS Score
0.004
Published
2023-02-20
app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.
CVSS Score
9.8
EPSS Score
0.001
Published
2023-02-20
MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.
CVSS Score
9.8
EPSS Score
0.001
Published
2023-02-20
In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.
CVSS Score
7.5
EPSS Score
0.001
Published
2023-02-20
A vulnerability was found in doomsider shadow. It has been classified as problematic. Affected is an unknown function. The manipulation leads to denial of service. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is told to be difficult. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 3332c5ba9ec3014ddc74e2147190a050eee97bc0. It is recommended to apply a patch to fix this issue. VDB-221478 is the identifier assigned to this vulnerability.
CVSS Score
2.5
EPSS Score
0.0
Published
2023-02-19
A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480.
CVSS Score
5.5
EPSS Score
0.001
Published
2023-02-19
A vulnerability was found in madgicweb BuddyStream Plugin up to 3.2.7 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file ShareBox.php. The manipulation of the argument content/link/shares leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.2.8 is able to address this issue. The patch is named 7d5b9a89a27711aad76fd55ab4cc4185b545a1d0. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221479.
CVSS Score
3.5
EPSS Score
0.001
Published
2023-02-19
Missing Authentication for Critical Function in GitHub repository kareadita/kavita prior to 0.7.0.
CVSS Score
8.1
EPSS Score
0.001
Published
2023-02-19